The United Kingdom has officially issued sweeping economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that blockchain and cybersecurity experts identify as a major financial conduit for ransomware operations, narcotics trafficking, darknet markets, fraud, and cybercrime services. According to investigators, the platform has played a crucial role in helping Russia circumvent existing international financial restrictions and maintain its wartime economy.
The British government announced the sanctions on October 8, targeting Cryptomus—which has previously operated under the corporate names Certa Payments and Xeltox Enterprises—for processing payments that directly benefit the Russian government and its financial institutions. The UK sanctions mandate an immediate freeze on any assets held by Cryptomus at British banks and strictly bar UK companies from conducting any form of business with the platform, virtual or otherwise. Alongside Cryptomus, the British government also targeted several other virtual payment platforms, including VexPay, TokenSpot, and the Tsunami Payments service.
The crackdown follows extensive investigative reporting, including a December 2024 deep-dive into how cryptocurrency is converted into cash within Russian banks. Over the years, Cryptomus has established itself as a primary payment processor for dozens of Russian cryptocurrency exchanges and online portals hawking illicit cybercrime services. Since emerging on the digital landscape in 2022, the company has repeatedly changed its corporate identity to evade law enforcement and regulatory scrutiny. Most recently, the platform rebranded itself as "Heleket" following a record-breaking CAD $176 million fine levied by Canadian authorities for severe anti-money laundering violations.
Industry experts emphasize that these latest UK measures target the broader, highly resilient infrastructure supporting Russia’s wartime financial networks. In an October 8 blog post, the prominent blockchain data-analytics firm Chainalysis highlighted the sheer scale of illicit activity moving through these channels. Chainalysis noted that Cryptomus and Heleket have rapidly evolved into primary payment hubs for illegal activity, pointing out that together, these services received more illicit funds across tracked categories than the cryptocurrency mixers in their dataset, with the number of illicit counterparties surging to over 900 in a single month during late 2025.
Additional findings from blockchain analytics firm TRM Labs in April 2026 revealed that Cryptomus had processed more than $7 billion in transactions since its inception in 2022. This massive volume included transactions tied to dangerous criminal enterprises, such as vendors distributing child sexual abuse material, international terrorist financing networks, and human trafficking operations. TRM Labs also observed that while Cryptomus experienced a temporary cratering in its transaction volume after implementing strict "know your customer" (KYC) compliance rules, the platform quickly adapted to regulatory pressure. Following the massive Canadian fines, the operators launched Heleket as a parallel service designed to continue processing payments without enforcing any KYC requirements.
Richard Sanders, a veteran blockchain analyst and investigator who spent months meticulously mapping out Cryptomus’s payment infrastructure and transacting directly with its users, argued that the UK sanctions represent a critical escalation in international enforcement. Sanders pointed out that Canada’s earlier financial penalties against the platform ultimately proved unenforceable and uncollectible. Writing on LinkedIn, Sanders noted that a fine alone does not stop a dedicated cryptocurrency payment processor from continuing to process illicit payments, emphasizing that full-scale sanctions are what ultimately disrupt and kill such operations.
During earlier investigative work, Sanders and other researchers uncovered that Cryptomus initially shared a registered office address in Vancouver with dozens of other foreign currency dealers and money transfer businesses, none of which appeared to have any physical presence at the location. Even after being hit with the CAD $176 million fine for alleged money laundering violations, Cryptomus chose to appeal the penalty, spun up Heleket as a parallel operational entity, and continued handling high volumes of suspicious and criminal transactions. Furthermore, Sanders noted that the UK action marks the first known instance of a "Five Eyes" intelligence-sharing nation—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—imposing direct sanctions on a cryptocurrency operation incorporated within another jurisdiction belonging to the Five Eyes alliance.
The murky origins of how entities like Cryptomus and Heleket manage to acquire the legal authority to offer international financial services point to an elaborate web of deception. Investigations revealed that the financial setup relies heavily on fake financial institutions overseen by a phony regulatory body positioned in a territory that is not widely recognized as a sovereign nation.
Specifically, the sole shareholder of Cryptomus’s original parent company, Certa Payments, was identified as a 25-year-old Ukrainian woman who also served as the head of several other corporate entities. Among these was the WS Management and Advisory Corporation, an organization that aggressively marketed itself as the exclusive regulatory body overseeing licensing for cryptocurrency, foreign exchange, and online gaming businesses incorporated within the disputed region of northwestern Africa known as the Western Sahara.
The official website for this regulatory body, operating under the domain crasadr.com, publicly claimed to assist applicants with corporate bank setup, company formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. Digital forensics further connected these entities, revealing that one of Certa Payments’ former websites shared a server infrastructure with a dozen other domains, including rasd-state.ws, which served as the website for the so-called Central Reserve Authority of the Western Sahara—the very organization purporting to grant legitimacy to the illicit financial platforms now targeted by British sanctions.
